Patch "Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-hci_sync-avoid-use-after-free-in-dbg-for-h.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ec0a018a1bff222d7b5dd9ca575ab70a295d6fda
Author: Manish Mandlik <mmandlik@xxxxxxxxxx>
Date:   Fri Aug 4 11:14:45 2023 -0700

    Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()
    
    [ Upstream commit a2bcd2b63271a93a695fabbfbf459c603d956d48 ]
    
    KSAN reports use-after-free in hci_add_adv_monitor().
    
    While adding an adv monitor,
        hci_add_adv_monitor() calls ->
        msft_add_monitor_pattern() calls ->
        msft_add_monitor_sync() calls ->
        msft_le_monitor_advertisement_cb() calls in an error case ->
        hci_free_adv_monitor() which frees the *moniter.
    
    This is referenced by bt_dev_dbg() in hci_add_adv_monitor().
    
    Fix the bt_dev_dbg() by using handle instead of monitor->handle.
    
    Fixes: b747a83690c8 ("Bluetooth: hci_sync: Refactor add Adv Monitor")
    Signed-off-by: Manish Mandlik <mmandlik@xxxxxxxxxx>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 561e8a77f64cd..146553c0054f6 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1957,7 +1957,7 @@ int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
 	case HCI_ADV_MONITOR_EXT_MSFT:
 		status = msft_add_monitor_pattern(hdev, monitor);
 		bt_dev_dbg(hdev, "add monitor %d msft status %d",
-			   monitor->handle, status);
+			   handle, status);
 		break;
 	}
 



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux